mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-11-23 05:55:40 +01:00
569 lines
18 KiB
Plaintext
569 lines
18 KiB
Plaintext
/* BEGIN_HEADER */
|
|
#include <mbedtls/ssl.h>
|
|
#include <mbedtls/ssl_internal.h>
|
|
|
|
/*
|
|
* Helper function setting up inverse record transformations
|
|
* using given cipher, hash, EtM mode, authentication tag length,
|
|
* and version.
|
|
*/
|
|
|
|
#define CHK( x ) \
|
|
do \
|
|
{ \
|
|
if( !( x ) ) \
|
|
{ \
|
|
ret = -1; \
|
|
goto cleanup; \
|
|
} \
|
|
} while( 0 )
|
|
|
|
|
|
static int build_transforms( mbedtls_ssl_transform *t_in,
|
|
mbedtls_ssl_transform *t_out,
|
|
int cipher_type, int hash_id,
|
|
int etm, int tag_mode, int ver )
|
|
{
|
|
mbedtls_cipher_info_t const *cipher_info;
|
|
int ret = 0;
|
|
|
|
size_t keylen, maclen, ivlen;
|
|
unsigned char *key0 = NULL, *key1 = NULL;
|
|
unsigned char iv_enc[16], iv_dec[16];
|
|
|
|
maclen = 0;
|
|
|
|
/* Pick cipher */
|
|
cipher_info = mbedtls_cipher_info_from_type( cipher_type );
|
|
CHK( cipher_info != NULL );
|
|
CHK( cipher_info->iv_size <= 16 );
|
|
CHK( cipher_info->key_bitlen % 8 == 0 );
|
|
|
|
/* Pick keys */
|
|
keylen = cipher_info->key_bitlen / 8;
|
|
/* Allocate `keylen + 1` bytes to ensure that we get
|
|
* a non-NULL pointers from `mbedtls_calloc` even if
|
|
* `keylen == 0` in the case of the NULL cipher. */
|
|
CHK( ( key0 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL );
|
|
CHK( ( key1 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL );
|
|
memset( key0, 0x1, keylen );
|
|
memset( key1, 0x2, keylen );
|
|
|
|
/* Setup cipher contexts */
|
|
CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_enc, cipher_info ) == 0 );
|
|
CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_dec, cipher_info ) == 0 );
|
|
CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_enc, cipher_info ) == 0 );
|
|
CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_dec, cipher_info ) == 0 );
|
|
|
|
#if defined(MBEDTLS_CIPHER_MODE_CBC)
|
|
if( cipher_info->mode == MBEDTLS_MODE_CBC )
|
|
{
|
|
CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_enc,
|
|
MBEDTLS_PADDING_NONE ) == 0 );
|
|
CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_dec,
|
|
MBEDTLS_PADDING_NONE ) == 0 );
|
|
CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_enc,
|
|
MBEDTLS_PADDING_NONE ) == 0 );
|
|
CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_dec,
|
|
MBEDTLS_PADDING_NONE ) == 0 );
|
|
}
|
|
#endif /* MBEDTLS_CIPHER_MODE_CBC */
|
|
|
|
CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_enc, key0,
|
|
keylen << 3, MBEDTLS_ENCRYPT ) == 0 );
|
|
CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_dec, key1,
|
|
keylen << 3, MBEDTLS_DECRYPT ) == 0 );
|
|
CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_enc, key1,
|
|
keylen << 3, MBEDTLS_ENCRYPT ) == 0 );
|
|
CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_dec, key0,
|
|
keylen << 3, MBEDTLS_DECRYPT ) == 0 );
|
|
|
|
/* Setup MAC contexts */
|
|
#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
|
|
if( cipher_info->mode == MBEDTLS_MODE_CBC ||
|
|
cipher_info->mode == MBEDTLS_MODE_STREAM )
|
|
{
|
|
mbedtls_md_info_t const *md_info;
|
|
unsigned char *md0, *md1;
|
|
|
|
/* Pick hash */
|
|
md_info = mbedtls_md_info_from_type( hash_id );
|
|
CHK( md_info != NULL );
|
|
|
|
/* Pick hash keys */
|
|
maclen = mbedtls_md_get_size( md_info );
|
|
CHK( ( md0 = mbedtls_calloc( 1, maclen ) ) != NULL );
|
|
CHK( ( md1 = mbedtls_calloc( 1, maclen ) ) != NULL );
|
|
memset( md0, 0x5, maclen );
|
|
memset( md1, 0x6, maclen );
|
|
|
|
CHK( mbedtls_md_setup( &t_out->md_ctx_enc, md_info, 1 ) == 0 );
|
|
CHK( mbedtls_md_setup( &t_out->md_ctx_dec, md_info, 1 ) == 0 );
|
|
CHK( mbedtls_md_setup( &t_in->md_ctx_enc, md_info, 1 ) == 0 );
|
|
CHK( mbedtls_md_setup( &t_in->md_ctx_dec, md_info, 1 ) == 0 );
|
|
|
|
if( ver > MBEDTLS_SSL_MINOR_VERSION_0 )
|
|
{
|
|
CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_enc,
|
|
md0, maclen ) == 0 );
|
|
CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_dec,
|
|
md1, maclen ) == 0 );
|
|
CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_enc,
|
|
md1, maclen ) == 0 );
|
|
CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_dec,
|
|
md0, maclen ) == 0 );
|
|
}
|
|
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
|
else
|
|
{
|
|
memcpy( &t_in->mac_enc, md0, maclen );
|
|
memcpy( &t_in->mac_dec, md1, maclen );
|
|
memcpy( &t_out->mac_enc, md1, maclen );
|
|
memcpy( &t_out->mac_dec, md0, maclen );
|
|
}
|
|
#endif
|
|
|
|
mbedtls_free( md0 );
|
|
mbedtls_free( md1 );
|
|
}
|
|
#else
|
|
((void) hash_id);
|
|
#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
|
|
|
|
|
|
/* Pick IV's (regardless of whether they
|
|
* are being used by the transform). */
|
|
ivlen = cipher_info->iv_size;
|
|
memset( iv_enc, 0x3, sizeof( iv_enc ) );
|
|
memset( iv_dec, 0x4, sizeof( iv_dec ) );
|
|
|
|
/*
|
|
* Setup transforms
|
|
*/
|
|
|
|
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
|
t_out->encrypt_then_mac = etm;
|
|
t_in->encrypt_then_mac = etm;
|
|
#else
|
|
((void) etm);
|
|
#endif
|
|
|
|
t_out->minor_ver = ver;
|
|
t_in->minor_ver = ver;
|
|
t_out->ivlen = ivlen;
|
|
t_in->ivlen = ivlen;
|
|
|
|
switch( cipher_info->mode )
|
|
{
|
|
case MBEDTLS_MODE_GCM:
|
|
case MBEDTLS_MODE_CCM:
|
|
t_out->fixed_ivlen = 4;
|
|
t_in->fixed_ivlen = 4;
|
|
t_out->maclen = 0;
|
|
t_in->maclen = 0;
|
|
switch( tag_mode )
|
|
{
|
|
case 0: /* Full tag */
|
|
t_out->taglen = 16;
|
|
t_in->taglen = 16;
|
|
break;
|
|
case 1: /* Partial tag */
|
|
t_out->taglen = 8;
|
|
t_in->taglen = 8;
|
|
break;
|
|
default:
|
|
return( 1 );
|
|
}
|
|
break;
|
|
|
|
case MBEDTLS_MODE_CHACHAPOLY:
|
|
t_out->fixed_ivlen = 12;
|
|
t_in->fixed_ivlen = 12;
|
|
t_out->maclen = 0;
|
|
t_in->maclen = 0;
|
|
switch( tag_mode )
|
|
{
|
|
case 0: /* Full tag */
|
|
t_out->taglen = 16;
|
|
t_in->taglen = 16;
|
|
break;
|
|
case 1: /* Partial tag */
|
|
t_out->taglen = 8;
|
|
t_in->taglen = 8;
|
|
break;
|
|
default:
|
|
return( 1 );
|
|
}
|
|
break;
|
|
|
|
case MBEDTLS_MODE_STREAM:
|
|
case MBEDTLS_MODE_CBC:
|
|
t_out->fixed_ivlen = 0; /* redundant, must be 0 */
|
|
t_in->fixed_ivlen = 0; /* redundant, must be 0 */
|
|
t_out->taglen = 0;
|
|
t_in->taglen = 0;
|
|
switch( tag_mode )
|
|
{
|
|
case 0: /* Full tag */
|
|
t_out->maclen = maclen;
|
|
t_in->maclen = maclen;
|
|
break;
|
|
case 1: /* Partial tag */
|
|
t_out->maclen = 10;
|
|
t_in->maclen = 10;
|
|
break;
|
|
default:
|
|
return( 1 );
|
|
}
|
|
break;
|
|
default:
|
|
return( 1 );
|
|
break;
|
|
}
|
|
|
|
/* Setup IV's */
|
|
|
|
memcpy( &t_in->iv_dec, iv_dec, sizeof( iv_dec ) );
|
|
memcpy( &t_in->iv_enc, iv_enc, sizeof( iv_enc ) );
|
|
memcpy( &t_out->iv_dec, iv_enc, sizeof( iv_enc ) );
|
|
memcpy( &t_out->iv_enc, iv_dec, sizeof( iv_dec ) );
|
|
|
|
cleanup:
|
|
|
|
mbedtls_free( key0 );
|
|
mbedtls_free( key1 );
|
|
|
|
return( ret );
|
|
}
|
|
|
|
/* END_HEADER */
|
|
|
|
/* BEGIN_DEPENDENCIES
|
|
* depends_on:MBEDTLS_SSL_TLS_C
|
|
* END_DEPENDENCIES
|
|
*/
|
|
|
|
/* BEGIN_CASE depends_on:MBEDTLS_SSL_DTLS_ANTI_REPLAY */
|
|
void ssl_dtls_replay( data_t * prevs, data_t * new, int ret )
|
|
{
|
|
uint32_t len = 0;
|
|
mbedtls_ssl_context ssl;
|
|
mbedtls_ssl_config conf;
|
|
|
|
mbedtls_ssl_init( &ssl );
|
|
mbedtls_ssl_config_init( &conf );
|
|
|
|
TEST_ASSERT( mbedtls_ssl_config_defaults( &conf,
|
|
MBEDTLS_SSL_IS_CLIENT,
|
|
MBEDTLS_SSL_TRANSPORT_DATAGRAM,
|
|
MBEDTLS_SSL_PRESET_DEFAULT ) == 0 );
|
|
TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == 0 );
|
|
|
|
/* Read previous record numbers */
|
|
for( len = 0; len < prevs->len; len += 6 )
|
|
{
|
|
memcpy( ssl.in_ctr + 2, prevs->x + len, 6 );
|
|
mbedtls_ssl_dtls_replay_update( &ssl );
|
|
}
|
|
|
|
/* Check new number */
|
|
memcpy( ssl.in_ctr + 2, new->x, 6 );
|
|
TEST_ASSERT( mbedtls_ssl_dtls_replay_check( &ssl ) == ret );
|
|
|
|
mbedtls_ssl_free( &ssl );
|
|
mbedtls_ssl_config_free( &conf );
|
|
}
|
|
/* END_CASE */
|
|
|
|
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
|
|
void ssl_set_hostname_twice( char *hostname0, char *hostname1 )
|
|
{
|
|
mbedtls_ssl_context ssl;
|
|
mbedtls_ssl_init( &ssl );
|
|
|
|
TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname0 ) == 0 );
|
|
TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname1 ) == 0 );
|
|
|
|
mbedtls_ssl_free( &ssl );
|
|
}
|
|
/* END_CASE */
|
|
|
|
/* BEGIN_CASE */
|
|
void ssl_crypt_record( int cipher_type, int hash_id,
|
|
int etm, int tag_mode, int ver )
|
|
{
|
|
/*
|
|
* Test several record encryptions and decryptions
|
|
* with plenty of space before and after the data
|
|
* within the record buffer.
|
|
*/
|
|
|
|
int ret;
|
|
int num_records = 16;
|
|
mbedtls_ssl_context ssl; /* ONLY for debugging */
|
|
|
|
mbedtls_ssl_transform t0, t1;
|
|
unsigned char *buf = NULL;
|
|
size_t const buflen = 512;
|
|
mbedtls_record rec, rec_backup;
|
|
|
|
mbedtls_ssl_init( &ssl );
|
|
mbedtls_ssl_transform_init( &t0 );
|
|
mbedtls_ssl_transform_init( &t1 );
|
|
TEST_ASSERT( build_transforms( &t0, &t1, cipher_type, hash_id,
|
|
etm, tag_mode, ver ) == 0 );
|
|
|
|
TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL );
|
|
|
|
while( num_records-- > 0 )
|
|
{
|
|
mbedtls_ssl_transform *t_dec, *t_enc;
|
|
/* Take turns in who's sending and who's receiving. */
|
|
if( num_records % 3 == 0 )
|
|
{
|
|
t_dec = &t0;
|
|
t_enc = &t1;
|
|
}
|
|
else
|
|
{
|
|
t_dec = &t1;
|
|
t_enc = &t0;
|
|
}
|
|
|
|
/*
|
|
* The record header affects the transformation in two ways:
|
|
* 1) It determines the AEAD additional data
|
|
* 2) The record counter sometimes determines the IV.
|
|
*
|
|
* Apart from that, the fields don't have influence.
|
|
* In particular, it is currently not the responsibility
|
|
* of ssl_encrypt/decrypt_buf to check if the transform
|
|
* version matches the record version, or that the
|
|
* type is sensible.
|
|
*/
|
|
|
|
memset( rec.ctr, num_records, sizeof( rec.ctr ) );
|
|
rec.type = 42;
|
|
rec.ver[0] = num_records;
|
|
rec.ver[1] = num_records;
|
|
|
|
rec.buf = buf;
|
|
rec.buf_len = buflen;
|
|
rec.data_offset = 16;
|
|
/* Make sure to vary the length to exercise different
|
|
* paddings. */
|
|
rec.data_len = 1 + num_records;
|
|
|
|
memset( rec.buf + rec.data_offset, 42, rec.data_len );
|
|
|
|
/* Make a copy for later comparison */
|
|
rec_backup = rec;
|
|
|
|
/* Encrypt record */
|
|
ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec,
|
|
rnd_std_rand, NULL );
|
|
TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
|
|
if( ret != 0 )
|
|
{
|
|
continue;
|
|
}
|
|
|
|
/* Decrypt record with t_dec */
|
|
TEST_ASSERT( mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec ) == 0 );
|
|
|
|
/* Compare results */
|
|
TEST_ASSERT( rec.type == rec_backup.type );
|
|
TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 );
|
|
TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] );
|
|
TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] );
|
|
TEST_ASSERT( rec.data_len == rec_backup.data_len );
|
|
TEST_ASSERT( rec.data_offset == rec_backup.data_offset );
|
|
TEST_ASSERT( memcmp( rec.buf + rec.data_offset,
|
|
rec_backup.buf + rec_backup.data_offset,
|
|
rec.data_len ) == 0 );
|
|
}
|
|
|
|
exit:
|
|
|
|
/* Cleanup */
|
|
mbedtls_ssl_free( &ssl );
|
|
mbedtls_ssl_transform_free( &t0 );
|
|
mbedtls_ssl_transform_free( &t1 );
|
|
|
|
mbedtls_free( buf );
|
|
}
|
|
/* END_CASE */
|
|
|
|
/* BEGIN_CASE */
|
|
void ssl_crypt_record_small( int cipher_type, int hash_id,
|
|
int etm, int tag_mode, int ver )
|
|
{
|
|
/*
|
|
* Test pairs of encryption and decryption with an increasing
|
|
* amount of space in the record buffer - in more detail:
|
|
* 1) Try to encrypt with 0, 1, 2, ... bytes available
|
|
* in front of the plaintext, and expect the encryption
|
|
* to succeed starting from some offset. Always keep
|
|
* enough space in the end of the buffer.
|
|
* 2) Try to encrypt with 0, 1, 2, ... bytes available
|
|
* at the end of the plaintext, and expect the encryption
|
|
* to succeed starting from some offset. Always keep
|
|
* enough space at the beginning of the buffer.
|
|
* 3) Try to encrypt with 0, 1, 2, ... bytes available
|
|
* both at the front and end of the plaintext,
|
|
* and expect the encryption to succeed starting from
|
|
* some offset.
|
|
*
|
|
* If encryption succeeds, check that decryption succeeds
|
|
* and yields the original record.
|
|
*/
|
|
|
|
mbedtls_ssl_context ssl; /* ONLY for debugging */
|
|
|
|
mbedtls_ssl_transform t0, t1;
|
|
unsigned char *buf = NULL;
|
|
size_t const buflen = 150;
|
|
mbedtls_record rec, rec_backup;
|
|
|
|
int ret;
|
|
int mode; /* Mode 1, 2 or 3 as explained above */
|
|
size_t offset; /* Available space at beginning/end/both */
|
|
size_t threshold = 64; /* Maximum offset to test against */
|
|
|
|
size_t default_pre_padding = 64; /* Pre-padding to use in mode 2 */
|
|
size_t default_post_padding = 64; /* Post-padding to use in mode 1 */
|
|
|
|
int seen_success; /* Indicates if in the current mode we've
|
|
* already seen a successful test. */
|
|
|
|
mbedtls_ssl_init( &ssl );
|
|
mbedtls_ssl_transform_init( &t0 );
|
|
mbedtls_ssl_transform_init( &t1 );
|
|
TEST_ASSERT( build_transforms( &t0, &t1, cipher_type, hash_id,
|
|
etm, tag_mode, ver ) == 0 );
|
|
|
|
TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL );
|
|
|
|
for( mode=1; mode <= 3; mode++ )
|
|
{
|
|
seen_success = 0;
|
|
for( offset=0; offset <= threshold; offset++ )
|
|
{
|
|
mbedtls_ssl_transform *t_dec, *t_enc;
|
|
/* Take turns in who's sending and who's receiving. */
|
|
if( offset % 2 == 0 )
|
|
{
|
|
t_dec = &t0;
|
|
t_enc = &t1;
|
|
}
|
|
else
|
|
{
|
|
t_dec = &t1;
|
|
t_enc = &t0;
|
|
}
|
|
|
|
memset( rec.ctr, offset, sizeof( rec.ctr ) );
|
|
rec.type = 42;
|
|
rec.ver[0] = offset;
|
|
rec.ver[1] = offset;
|
|
rec.buf = buf;
|
|
rec.buf_len = buflen;
|
|
|
|
switch( mode )
|
|
{
|
|
case 1: /* Space in the beginning */
|
|
rec.data_offset = offset;
|
|
rec.data_len = buflen - offset - default_post_padding;
|
|
break;
|
|
|
|
case 2: /* Space in the end */
|
|
rec.data_offset = default_pre_padding;
|
|
rec.data_len = buflen - default_pre_padding - offset;
|
|
break;
|
|
|
|
case 3: /* Space in the beginning and end */
|
|
rec.data_offset = offset;
|
|
rec.data_len = buflen - 2 * offset;
|
|
break;
|
|
|
|
default:
|
|
TEST_ASSERT( 0 );
|
|
break;
|
|
}
|
|
|
|
memset( rec.buf + rec.data_offset, 42, rec.data_len );
|
|
|
|
/* Make a copy for later comparison */
|
|
rec_backup = rec;
|
|
|
|
/* Encrypt record */
|
|
ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec, rnd_std_rand, NULL );
|
|
|
|
if( ( mode == 1 || mode == 2 ) && seen_success )
|
|
{
|
|
TEST_ASSERT( ret == 0 );
|
|
}
|
|
else
|
|
{
|
|
TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
|
|
if( ret == 0 )
|
|
seen_success = 1;
|
|
}
|
|
|
|
if( ret != 0 )
|
|
continue;
|
|
|
|
/* Decrypt record with t_dec */
|
|
TEST_ASSERT( mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec ) == 0 );
|
|
|
|
/* Compare results */
|
|
TEST_ASSERT( rec.type == rec_backup.type );
|
|
TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 );
|
|
TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] );
|
|
TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] );
|
|
TEST_ASSERT( rec.data_len == rec_backup.data_len );
|
|
TEST_ASSERT( rec.data_offset == rec_backup.data_offset );
|
|
TEST_ASSERT( memcmp( rec.buf + rec.data_offset,
|
|
rec_backup.buf + rec_backup.data_offset,
|
|
rec.data_len ) == 0 );
|
|
}
|
|
|
|
TEST_ASSERT( seen_success == 1 );
|
|
}
|
|
|
|
exit:
|
|
|
|
/* Cleanup */
|
|
mbedtls_ssl_free( &ssl );
|
|
mbedtls_ssl_transform_free( &t0 );
|
|
mbedtls_ssl_transform_free( &t1 );
|
|
|
|
mbedtls_free( buf );
|
|
}
|
|
/* END_CASE */
|
|
|
|
/* BEGIN_CASE */
|
|
void ssl_tls_prf( int type, data_t * secret, data_t * random,
|
|
char *label, data_t *result_hex_str, int exp_ret )
|
|
{
|
|
unsigned char *output;
|
|
|
|
output = mbedtls_calloc( 1, result_hex_str->len );
|
|
if( output == NULL )
|
|
goto exit;
|
|
|
|
TEST_ASSERT( mbedtls_ssl_tls_prf( type, secret->x, secret->len,
|
|
label, random->x, random->len,
|
|
output, result_hex_str->len ) == exp_ret );
|
|
|
|
if( exp_ret == 0 )
|
|
{
|
|
TEST_ASSERT( hexcmp( output, result_hex_str->x,
|
|
result_hex_str->len, result_hex_str->len ) == 0 );
|
|
}
|
|
exit:
|
|
|
|
mbedtls_free( output );
|
|
}
|
|
/* END_CASE */
|